cloud-recon
Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in…
A command is the one you type. It runs exactly when you ask it to, and never before.
523 commands across 665 plugins.
Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in…
On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory…
Inspect or rotate the autopilot ledger JSONL files (findings.jsonl, negatives.jsonl). Caps file size and keeps N rotated backups so memory does not grow…
Pick up a previous hunt on a target — shows hunt history and untested surface from the autopilot ledger. Usage: /pickup target.com
Expand and correlate an existing case — peers, shared indicators, TLS overlap, reverse-WHOIS. Usage: /cti-cluster <domain|CASE-ID>
Collect pivot artifacts from ONE target — favicon, trackers, wallets, emails, CORS, mail/SPF/DMARC, WHOIS, co-tenancy. Usage: /cti-pivot <url|domain|ip>…
Manage the egress proxy / rotation pool for the skill's HTTP(S) requests (keyless crt.sh, Wayback, urlscan, CLD, WHOIS, /apikeys test; raw TLS/JARM probes need…
Create an editable draw.io grc audit workflow diagram for GRC professionals
Find the canonical fix commit(s) for a CVE across sources, then diff for root cause
Mine recent agent history (claude-mem + usage stats) for recurring failures and repeated patterns, audit MEMORY.md health, and PROPOSE (never apply)…
Plamen v2 Smart Contract audit wizard. Collects config, launches deterministic driver.
Connect to a Metasploit-Kali Server (MKS) REST API — verifies connectivity, discovers available Kali tools, and configures agents to prefer MKS endpoints over…
Define or update engagement scope — saves scope to disk without launching a pentest. Can be run before or during an engagement. If a pentest is active and the…
Incident response workflow — triage, evidence collection, timeline, and IOC extraction
Post-exploitation workflow after getting shell access — privesc, credential harvest, lateral movement
Aggregate audit checkpoints into the final report — executive summary, Scope Coverage, findings by severity, maturity scorecard, and remediation roadmap.
Deep single-instruction / single-function security review using the instruction worksheet, context reconstruction, and adversarial exploit modeling.
PR / commit-scoped differential audit — audits only changed functions (plus 1-hop callers), flags removed security checks, and prioritizes by risk × blast…
Full CVE hunting pipeline. Usage: /hunt <package-name>. Orchestrates all agents: registry check, clone, code review, PoC build, validation, and report…
Find targets in a category. Usage: /recon <category>. Examples: /recon csv-parsers, /recon template-engines, /recon archive-libs.
Query or update the research registry. Usage: /registry [query]. Examples: /registry stats, /registry check lodash, /registry list in-progress.
Query the Android/AOSP kernel CVE database by CVE id, version, build date, or branch
Deep scan of Windows Registry for malware persistence and unauthorized modifications
Scan file system for suspicious files in common malware locations
Define and authorize the target scope for a penetration testing engagement. This is the **mandatory first step** — all other commands refuse to run without an…
Display the engagement progress dashboard. Read-only — does not modify any state files.
Cross-phase audit of all outstanding Evidence Review and findings validation items
Audit milestone completion against original intent before archiving
[stable] End-to-end security audit with hotspot-aware framework pivots, shared findings.json schema, and CI-friendly workflow flags
[beta] Audit a decompiled Android target — scans jadx_out/sources + apktool_out together and merges findings
[experimental] Security mutation testing -- weaken security controls and check if the scanner detects the resulting vulnerability
Password brute force and hash cracking against target services
Resume or execute an attack campaign with progress tracking
Malware classification — YARA scanning, entropy analysis, packer detection
List active AKA detection exceptions (masked) from the local store
Audit third-party dependencies — resolve installed versions, cross-reference known-vulnerable releases, and flag vendored code that has diverged from upstream.
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic